DNS Records Lookup Authoritative DNS-over-HTTPS (DoH) Record Resolver
Query global DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA) with DNSSEC verification and sub-millisecond DoH queries.
DNS-over-HTTPS (DoH) Architecture
Modern recursive resolvers use encrypted DoH protocols (RFC 8484) to eliminate plain-text UDP queries and prevent MITM DNS spoofing.
Encrypted Transport
DNS queries are encapsulated in HTTP/2 or HTTP/3 over TLS, shielding query hostnames from ISP monitoring and local network sniffing.
DNSSEC Authenticity
Cryptographic signatures (RRSIG and DS records) validate that response data exactly matches the domain owner’s zone file.
Anycast Performance
Global Anycast edge nodes resolve records in single-digit milliseconds with edge caching and automatic zone synchronization.
DNS Record Types Reference Guide
Understand the role and security implications of standard DNS resource records.
A (IPv4 Address)
AMaps a human-readable domain name directly to a 32-bit IPv4 address.
Why it matters: The foundational record of the web, enabling browsers to connect to host web servers over IPv4.
AAAA (IPv6 Address)
AAAAMaps a domain name to a 128-bit next-generation IPv6 address.
Why it matters: Essential for modern high-speed internet routing, dual-stack networks, and mobile connectivity.
MX (Mail Exchange)
MXSpecifies the mail servers responsible for accepting incoming email on behalf of the domain.
Why it matters: Required for reliable email routing with priority weighting and fallback server configuration.
TXT (Text & Security Policies)
TXTCarries arbitrary text metadata, most crucially SPF, DKIM, DMARC, and domain ownership tokens.
Why it matters: Critical for email anti-spoofing security (preventing phishing) and third-party SaaS domain validation.
NS (Name Server)
NSDelegates a DNS zone to use authoritative DNS servers (e.g. Cloudflare, Route53).
Why it matters: Tells global resolvers which nameservers hold the master source-of-truth records for this domain.
CNAME (Canonical Name)
CNAMEAliases one domain or subdomain name to another canonical domain name.
Why it matters: Simplifies management of subdomains (e.g., www, app, docs) pointing to CDNs or cloud hostnames.
SOA (Start of Authority)
SOAStores core zone administrative info, including primary nameserver, admin email, serial number, and refresh timers.
Why it matters: Coordinates secondary DNS synchronization and dictates negative caching (NXDOMAIN TTL) behavior.
CAA (Certification Authority Authorization)
CAARestricts which Certificate Authorities (CAs like Let's Encrypt, DigiCert) are allowed to issue SSL/TLS certificates.
Why it matters: Prevents rogue or compromised CAs from issuing illegitimate certificates for your domain.
Frequently Asked Questions
What is DNS-over-HTTPS (DoH) and why is it safer?
+
Traditional DNS queries travel unencrypted over UDP port 53, making them vulnerable to eavesdropping, ISP tracking, and DNS spoofing / cache poisoning attacks. DNS-over-HTTPS (DoH, RFC 8484) encrypts DNS lookups inside standard HTTPS traffic, protecting your privacy and preventing man-in-the-middle manipulation.
What does TTL (Time to Live) mean in DNS records?
+
TTL indicates the number of seconds that DNS resolvers and ISP recursive caches are permitted to store the answer before querying the authoritative nameserver again. A TTL of 300 means 5 minutes, while 86400 means 24 hours.
How does DNSSEC provide authenticity?
+
Domain Name System Security Extensions (DNSSEC) uses public-key cryptography to digitally sign DNS records. Validating resolvers verify that DNS responses originated from the legitimate zone owner and were not forged in transit.
Why do my updated DNS records take time to propagate?
+
DNS propagation delay is primarily driven by intermediate resolver caching governed by previous record TTL values. Until the old cache entries expire worldwide, some visitors may still receive the previous record values.